tickmarkr 2.6.2 → 2.6.3

package/dist/config/config.js

@@ -325,7 +325,8 @@ const ShapeGateParticipationSchema = z
 });
 export const ExecutionPolicySchema = z.object({
     boundedInfrastructure: z.boolean().default(false),
-    repairSelection: z.boolean().default(false),
+    // OBS-1199: absent inherits the effective default (on); an explicit false stays off.
+    repairSelection: z.boolean().optional(),
     taskExecutionLimitMs: z.number().int().positive(),
 }).strict();
 export const TickmarkrConfigSchema = z.object({
@@ -408,6 +409,12 @@ export const TickmarkrConfigSchema = z.object({
         tipTest: z.string(),
         lint: z.string(),
         diffCap: z.number().int().positive(),
+        // OBS-1140: per-run gate-evidence byte quota; the oldest artifacts are evicted (and tombstoned)
+        // past it. Zero retains zero artifact bytes. Evidence retention never changes a gate's pass bit.
+        evidenceQuotaBytes: z.number().int().nonnegative(),
+        // OBS-1199: repair rounds screen known failing files plus affected tests before the full suite
+        // that still decides every merge. On unless false here or in executionPolicy, on every driver.
+        repairSelection: z.boolean(),
         byShape: z.partialRecord(z.enum(SHAPES), ShapeGateParticipationSchema).optional(),
     }).partial(),
     scope: z.object({
@@ -488,6 +495,7 @@ function assertSeededModelWindows() {
         }
     }
 }
+export const DEFAULT_EVIDENCE_QUOTA_BYTES = 8 * 1024 * 1024;
 export const DEFAULT_CONFIG = {
     concurrency: 3,
     driver: "auto",
@@ -660,7 +668,7 @@ export const DEFAULT_CONFIG = {
         },
     },
     pricing: { cheap: 0.1, mid: 0.5, frontier: 2.5 },
-    gates: { diffCap: DEFAULT_DIFF_CAP },
+    gates: { diffCap: DEFAULT_DIFF_CAP, evidenceQuotaBytes: DEFAULT_EVIDENCE_QUOTA_BYTES },
     judge: { adapter: "claude-code", model: "fable" },
     // R3: no `policy` floor — the neutral floor leaves the compiler's per-task assignment standing, so
     // the path-keyed rule is reachable out of the box rather than raised to full by construction.
@@ -818,12 +826,41 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
 }
 /** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
  *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
- *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+ *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited.
+ *  OBS-1188: an unparseable global file, or a non-map where this path expects a map, is an error —
+ *  never an empty lower layer, which would silently drop the metadata a write must re-mask. */
 export function lowerLayerModelOverrides(opts = {}) {
     const isMap = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-    const merged = deepMerge(structuredClone(DEFAULT_CONFIG), readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml")));
-    const tiers = isMap(merged) && isMap(merged.tiers) ? merged.tiers : {};
-    return Object.fromEntries(Object.entries(tiers).map(([adapter, entry]) => [adapter, Object.fromEntries(Object.entries(isMap(entry) && isMap(entry.modelOverrides) ? entry.modelOverrides : {}).filter(([, o]) => isMap(o)))]));
+    const path = join(opts.globalDir ?? globalConfigDir(), "config.yaml");
+    let global;
+    try {
+        global = readYaml(path);
+    }
+    catch (error) {
+        return { ok: false, error: `lower config layer ${path} is malformed YAML: ${error.message.replace(/\s+/g, " ").trim()}` };
+    }
+    const malformed = (at) => ({ ok: false, error: `lower config layer ${path} is malformed: ${at} is not a map` });
+    // deepMerge replaces a map with any non-map the global declares, so the merged shape is the global's
+    const merged = deepMerge(structuredClone(DEFAULT_CONFIG), global);
+    if (!isMap(merged))
+        return malformed("the document");
+    const tiers = merged.tiers ?? {}; // a global `tiers: null` tombstone leaves no lower tiers
+    if (!isMap(tiers))
+        return malformed("tiers");
+    const overrides = {};
+    for (const [adapter, entry] of Object.entries(tiers)) {
+        if (!isMap(entry))
+            return malformed(`tiers.${adapter}`);
+        const models = entry.modelOverrides ?? {};
+        if (!isMap(models))
+            return malformed(`tiers.${adapter}.modelOverrides`);
+        for (const [model, override] of Object.entries(models)) {
+            if (!isMap(override))
+                return malformed(`tiers.${adapter}.modelOverrides.${model}`);
+        }
+        overrides[adapter] = models;
+    }
+    return { ok: true, overrides };
 }
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;

package/dist/config/fleet-overlay.d.ts

@@ -1,7 +1,7 @@
-import { type FleetEditable, type FleetUniverseRow, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
-export type FleetOverlayWrite = {
+type FleetOverlayWriteFields = {
     initial: FleetEditable;
     edited: FleetEditable;
     mode?: RoutingMode;
@@ -20,8 +20,17 @@ export type FleetOverlayWrite = {
         };
     };
     universe?: FleetUniverseRow[];
-    lowerOverrides?: Record<string, Record<string, Record<string, unknown>>>;
 };
+type EffortFree = FleetEditable & {
+    efforts?: undefined;
+};
+export type FleetOverlayWrite = FleetOverlayWriteFields & ({
+    lowerOverrides: LowerLayerModelOverrides;
+} | {
+    initial: EffortFree;
+    edited: EffortFree;
+    lowerOverrides?: undefined;
+});
 export type FleetFirstTouch = {
     vendor: string;
     channel: "sub" | "api";
@@ -36,3 +45,4 @@ export declare function repoOverlayYaml(overlay: Record<string, unknown>): strin
 export declare function serializeFleetOverlay(overlay: Record<string, unknown>): string;
 export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;
 export declare function fleetEditableEquals(a: FleetEditable, b: FleetEditable): boolean;
+export {};

package/dist/config/fleet-overlay.js

@@ -368,27 +368,32 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             const after = efforts(edited)[adapter]?.[model];
             if (efforts(initial)[adapter]?.[model] === after)
                 continue;
+            // OBS-1188: the type already demands lower state here; this refuses a cast/JS caller before the
+            // bytes are returned, so a blind effort write never reaches disk.
+            const lowerAll = write.lowerOverrides;
+            if (!lowerAll) {
+                throw new Error(`fleet write: the effort edit on ${adapter}:${model} needs the lower config layers' model overrides — refusing to write it blind`);
+            }
             const override = ["tiers", adapter, "modelOverrides", model];
             if (after !== undefined) {
                 // Setting beneath a tombstone (the override, or modelOverrides above it) lifts it, and
                 // deepMerge would restore what it masked: re-mask each lower-layer key it covered — sibling
-                // models, then this override's vendor/channel (unknown lower ⇒ both, blind).
+                // models, then this override's own keys.
                 // ponytail: tiers.<adapter> itself tombstoned is unreachable here — its models, and so a tier, are masked too.
                 const tombstoned = (depth) => {
                     const node = doc.getIn(override.slice(0, depth), true);
                     return node !== undefined && !isMap(node);
                 };
-                const lowerModels = write.lowerOverrides?.[adapter] ?? {};
+                const lowerModels = lowerAll[adapter] ?? {};
                 const remask = [];
                 if (tombstoned(3))
                     for (const other of Object.keys(lowerModels))
                         if (other !== model)
                             remask.push([...override.slice(0, 3), other]);
                 if (tombstoned(3) || tombstoned(4)) {
-                    for (const key of write.lowerOverrides ? Object.keys(lowerModels[model] ?? {}) : ["vendor", "channel"]) {
+                    for (const key of Object.keys(lowerModels[model] ?? {}))
                         if (key !== "effort")
                             remask.push([...override, key]);
-                    }
                 }
                 setScalarPreservingComment(doc, [...override, "effort"], after);
                 for (const path of remask)
@@ -396,11 +401,10 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 continue;
             }
             // Clearing means no effort in the MERGED config: drop the repo key, then mask an effort the
-            // lower layers still declare (unknown lower ⇒ a repo that never held the key inherited it).
-            const held = doc.getIn([...override, "effort"]) !== undefined;
+            // lower layers still declare.
             deleteAt(doc, [...override, "effort"]);
-            const lower = write.lowerOverrides?.[adapter]?.[model];
-            const maskEffort = write.lowerOverrides ? lower?.effort !== undefined : !held;
+            const lower = lowerAll[adapter]?.[model];
+            const maskEffort = lower?.effort !== undefined;
             const repoNode = doc.getIn(override, true);
             const { effort: _masked, ...rest } = { ...lower, ...(isMap(repoNode) ? repoNode.toJSON() : {}) };
             if (Object.values(rest).some((v) => v !== null && v !== undefined)) {

package/dist/drivers/herdr.d.ts

@@ -62,6 +62,8 @@ export declare class HerdrDriver implements ExecutorDriver {
     private deliverySerial;
     private dispatchLeases;
     private deliveredPanes;
+    /** OBS-1203: slots bound by adopt() — their reads are harvest evidence, so a failed read throws. */
+    private adoptedSlots;
     private inputBoxes;
     private bootstraps;
     private journalRoots;
@@ -93,6 +95,16 @@ export declare class HerdrDriver implements ExecutorDriver {
     private paneId;
     private paneWidth;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    /**
+     * OBS-1203: bind THIS instance, READ-ONLY, to the pane an earlier daemon created for an owned slot,
+     * so a resumed daemon can read the interrupted attempt's trailer. slot() is never a substitute: it
+     * allocates a tab, reclaimStaleLabel closes the very pane holding the evidence, and it holds a
+     * dispatch lease only run() releases. Binding needs ownership evidence, never a label alone: exactly
+     * one pane carries the FULL owned label, herdr reports that pane's cwd as the journaled task
+     * checkout, and that path is a git checkout whose own top level it is. Zero, ambiguous or foreign
+     * candidates throw — the caller's decline. `pane list` and `git rev-parse` are the only calls made.
+     */
+    adopt(slot: Slot): Promise<Slot>;
     private tabSlot;
     private reclaimStaleLabel;
     private staleLabelPanes;

package/dist/drivers/herdr.js

@@ -7,6 +7,7 @@ import { consumePaneLaunchIntent, PANE_IDENTITY_ENV, paneIdentityLine } from "..
 import { createWorktree, sh } from "../run/git.js";
 import { Journal } from "../run/journal.js";
 import { readSupervision, readWatchBoard, requestWatchBoardStop, reserveWatchBoard, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
+import { canonicalWorktreePath } from "./orca.js";
 import { herdrSealShellPrefix } from "./subprocess.js";
 import { canonicalizeLegacyName, formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // VIS-09 P43-03: adopted safety floor from 43-MEASUREMENT.md (narrowest safe 53 → floor 108).
@@ -153,6 +154,8 @@ export class HerdrDriver {
     deliverySerial = Promise.resolve();
     dispatchLeases = new WeakMap();
     deliveredPanes = new WeakMap();
+    /** OBS-1203: slots bound by adopt() — their reads are harvest evidence, so a failed read throws. */
+    adoptedSlots = new WeakSet();
     inputBoxes = new WeakMap();
     // OBS-253: the adapter-declared bootstrap this slot has already delivered. A fresh pane is a bare
     // shell, so it is the only thing that can put a TUI back under a typed turn that has to move.
@@ -452,6 +455,49 @@ export class HerdrDriver {
         // refcount, no groupSerial, no degrade latch — dedicated tabs have no shared state to guard (SUP-01).
         return slot; // label undefined → defaults to name (today's behavior)
     }
+    /**
+     * OBS-1203: bind THIS instance, READ-ONLY, to the pane an earlier daemon created for an owned slot,
+     * so a resumed daemon can read the interrupted attempt's trailer. slot() is never a substitute: it
+     * allocates a tab, reclaimStaleLabel closes the very pane holding the evidence, and it holds a
+     * dispatch lease only run() releases. Binding needs ownership evidence, never a label alone: exactly
+     * one pane carries the FULL owned label, herdr reports that pane's cwd as the journaled task
+     * checkout, and that path is a git checkout whose own top level it is. Zero, ambiguous or foreign
+     * candidates throw — the caller's decline. `pane list` and `git rev-parse` are the only calls made.
+     */
+    async adopt(slot) {
+        if (!parseOwnedName(slot.name))
+            throw new Error(`herdr adopt: slot ${slot.name} carries no owned label — nothing to adopt`);
+        const listed = await this.herdr("pane list");
+        let panes;
+        try {
+            const parsed = JSON.parse(listed.stdout).result?.panes;
+            if (listed.code !== 0 || !Array.isArray(parsed))
+                throw new Error("no panes array");
+            panes = parsed;
+        }
+        catch {
+            throw new Error(`herdr adopt: pane list unreadable (exit ${listed.code}) — cannot prove ownership of ${slot.name}`);
+        }
+        const owned = panes.filter((p) => p.label === slot.name && typeof p.pane_id === "string" && p.pane_id);
+        if (owned.length !== 1) {
+            throw new Error(`herdr adopt: ${owned.length === 0 ? "no pane carries" : `${owned.length} panes carry`} the owned label ${slot.name}`);
+        }
+        const pane = owned[0];
+        const checkout = canonicalWorktreePath(slot.cwd);
+        if (typeof pane.cwd !== "string" || canonicalWorktreePath(pane.cwd) !== checkout) {
+            throw new Error(`herdr adopt: pane ${pane.pane_id} labelled ${slot.name} sits in ${pane.cwd ?? "an unreported cwd"}, not the task checkout ${checkout} — foreign`);
+        }
+        const top = await sh("git rev-parse --show-toplevel", checkout);
+        if (top.code !== 0 || canonicalWorktreePath(top.stdout.trim()) !== checkout) {
+            throw new Error(`herdr adopt: ${checkout} is not its own git checkout — no checkout proof for ${slot.name}`);
+        }
+        const adopted = { id: pane.pane_id, name: slot.name, cwd: slot.cwd,
+            ...(pane.tab_id === undefined ? {} : { tabId: pane.tab_id }), ...(slot.group === undefined ? {} : { group: slot.group }) };
+        // Reads go to the pane ownership was proven on, never to a later re-resolution of the label.
+        this.deliveredPanes.set(adopted, pane.pane_id);
+        this.adoptedSlots.add(adopted);
+        return adopted;
+    }
     // today's per-slot tab path, plus the VIS-04 orphan reap
     // label defaults to the slot name; group tabs pass the STAGE name instead — a first-member label
     // outlives its member once keepPanes reaps it (run-20260709-104447: the codex pane sat in a tab
@@ -1099,6 +1145,11 @@ export class HerdrDriver {
     async read(slot, lines) {
         const pane = await this.paneId(slot);
         const r = await this.herdr(`pane read ${shq(pane)} --source recent-unwrapped --lines ${lines}`, slot.cwd);
+        // OBS-1203 review: an adopted pane's read decides a resume harvest; a failed read proves neither a
+        // trailer nor its absence, so it throws (the caller's decline) rather than read as an empty pane.
+        // ponytail: other slots keep the historical empty-on-failure read; widen once seed/consult callers catch.
+        if (r.code !== 0 && this.adoptedSlots.has(slot))
+            throw new Error(`herdr pane read ${pane} failed (exit ${r.code}): ${r.stderr || r.stdout}`);
         return r.stdout;
     }
     // v1.22 T5 / OBS-19: raw keystroke into the pane TUI (trust-dialog auto-answer). Resolves the pane

package/dist/drivers/orca.d.ts

@@ -274,7 +274,15 @@ export declare class OrcaDriver implements ExecutorDriver {
      */
     private screenBehindBlindStream;
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
-    private readScreen;
+    private screenFrame;
+    /**
+     * OBS-1205: the public rendered-screen read a slot carries (Slot.readScreen). Kimi draws its trust
+     * modal with cursor addressing, so the stream holds the box rules and no `Trust` text while the
+     * painted frame shows `❯ Trust this folder`. Same ownership discipline as every read — bound
+     * runtime, addressed handle, running status — and a frame the runtime could not render is
+     * unreadable, never an empty screen a caller could read as "no modal".
+     */
+    readScreen(slot: Slot): Promise<string>;
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split
      *  across cursor pages are not reassembled here; that is waitOutput's job. */
     read(slot: Slot, lines: number): Promise<string>;

package/dist/drivers/orca.js

@@ -719,7 +719,8 @@ export class OrcaDriver {
                 this.pendingProjects.delete(owned.taskId);
             }
         }
-        return { id, name: title, cwd: worktree, group: opts?.group };
+        const slot = { id, name: title, cwd: worktree, group: opts?.group, readScreen: () => this.readScreen(slot) };
+        return slot;
     }
     /**
      * OBS-1109: bind THIS instance to a terminal an earlier daemon created for an OWNED slot, so a
@@ -1175,14 +1176,14 @@ export class OrcaDriver {
             throw new OrcaUnavailableError(family, `exited-shaped stream page: show answered by runtime ${show.runtimeId}, not the bound ${st.runtimeId}`, show.raw, "exited");
         }
         this.liveShowTerm(family, st, show);
-        const screen = await this.readScreen(st);
+        const screen = await this.screenFrame(st);
         if (screen.source !== "screen") {
             throw new OrcaUnavailableError(family, `exited-shaped stream page and no rendered screen for ${st.handle}`, blind.raw, "exited");
         }
         return screen.term;
     }
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
-    async readScreen(st) {
+    async screenFrame(st) {
         const env = await this.terminalOp("status", st, (h) => this.call("read", [
             "terminal", "read", "--terminal", h, "--screen",
         ], this.cliCwd(st)));
@@ -1193,6 +1194,20 @@ export class OrcaDriver {
         }
         return { term, source };
     }
+    /**
+     * OBS-1205: the public rendered-screen read a slot carries (Slot.readScreen). Kimi draws its trust
+     * modal with cursor addressing, so the stream holds the box rules and no `Trust` text while the
+     * painted frame shows `❯ Trust this folder`. Same ownership discipline as every read — bound
+     * runtime, addressed handle, running status — and a frame the runtime could not render is
+     * unreadable, never an empty screen a caller could read as "no modal".
+     */
+    async readScreen(slot) {
+        const st = this.state(slot);
+        const { term, source } = await this.screenFrame(st);
+        if (source !== "screen")
+            throw new OrcaUnavailableError("read", `no rendered screen for ${st.handle}`, "");
+        return this.tailText("read", term, "");
+    }
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split
      *  across cursor pages are not reassembled here; that is waitOutput's job. */
     async read(slot, lines) {
@@ -1269,7 +1284,7 @@ export class OrcaDriver {
             // reporting even when the show record alone would still look connected (show carries no
             // status field of its own, so a terminal can report "unknown"/"exited" on read while its
             // show row still says connected — the read leg is the only place that catches that).
-            const screen = await this.readScreen(st);
+            const screen = await this.screenFrame(st);
             if (`${st.runtimeId}:${st.handle}:${st.recoveries}` !== gen) {
                 continue;
             }
@@ -1407,7 +1422,7 @@ export class OrcaDriver {
     async sendKey(slot, key) {
         const st = this.state(slot);
         this.assertAvailable("send", st);
-        if (key === "enter") {
+        if (key === "enter" || key === "Enter") { // "Enter": every adapter's declared trust key (OBS-1205)
             await this.sendText(st, "");
             return;
         }
@@ -1440,7 +1455,7 @@ export class OrcaDriver {
                 return true;
             const deadline = this.time.now() + NUDGE_ECHO_TIMEOUT_MS;
             for (;;) {
-                const screen = await this.readScreen(st);
+                const screen = await this.screenFrame(st);
                 // ponytail: "composer emptied" is "the text is no longer on the frame" — a TUI that keeps the
                 // submitted turn on screen reads as undelivered until the timeout; the receipt stage is primary.
                 if (screen.source === "screen") {
@@ -1853,7 +1868,7 @@ export class OrcaDriver {
         const st = this.slots.get(slot.id);
         if (!st)
             return;
-        if (st.handle) {
+        if (st.handle && !st.swept) {
             await this.closeTerminal(st);
         }
         this.slots.delete(slot.id);
@@ -2022,6 +2037,13 @@ export class OrcaDriver {
                         recoveries: 0,
                         recovering: false,
                     });
+                    // A kept slot whose attempt the journal fold already retired (a seed readiness deadline
+                    // parks one) can still hold this exact terminal; its own close() must not re-address a
+                    // handle this driver just closed, or the run-end sweep latches on the vanished tab.
+                    for (const st of this.slots.values()) {
+                        if (st.handle === c.paneId && st.runtimeId === env.runtimeId)
+                            st.swept = true;
+                    }
                 }
                 catch { /* vanished, stale, or no longer provably ours — never a blind retry */ }
             }

package/dist/drivers/types.d.ts

@@ -5,6 +5,7 @@ export interface Slot {
     cwd: string;
     tabId?: string;
     group?: string;
+    readScreen?: () => Promise<string>;
 }
 export type NotifyTier = "routine" | "attention" | "decision";
 export interface NotifyOpts {
@@ -92,6 +93,7 @@ export interface ExecutorDriver {
     focus?(target: FocusTarget): Promise<FocusResult>;
     describe?(slot: Slot): SlotPlacement | Promise<SlotPlacement> | undefined;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    adopt?(slot: Slot): Promise<Slot>;
     run(slot: Slot, cmd: string): Promise<void>;
     waitOutput(slot: Slot, pattern: string, timeoutMs: number, opts?: {
         regex?: boolean;

package/dist/drivers/types.js

@@ -63,8 +63,8 @@ export function canonicalizeLegacyName(name, runId) {
         return { role: "worker", taskId: w[1], attempt: Number(w[2]), runId: `run-${w[3]}` };
     const g = GATE_ROLE_RE.exec(name);
     if (g) {
-        const retry = g[2].endsWith("-r1");
-        return { role: g[1], taskId: retry ? g[2].slice(0, -3) : g[2], attempt: retry ? 1 : 0, runId };
+        const hop = /-r([1-9])$/.exec(g[2]);
+        return { role: g[1], taskId: hop ? g[2].slice(0, -hop[0].length) : g[2], attempt: hop ? Number(hop[1]) : 0, runId };
     }
     if (NARRATOR_RE.test(name))
         return { role: "watch", taskId: "run", attempt: 0, runId };

package/dist/gates/acceptance.d.ts

@@ -55,6 +55,13 @@ export type AcceptanceCorpusAuditResult = {
     };
 };
 export declare function auditAcceptanceCorpus(corpusRoot: string, listedTests: readonly VitestListedTest[]): AcceptanceCorpusAuditResult[];
+/** OBS-1151: one criterion of a parsed judge verdict, as the contradiction check compares it. */
+export interface JudgedCriterion {
+    id: string;
+    criterion: string;
+    met: boolean;
+    paths: string[];
+}
 export interface AcceptanceGateOpts {
     testCmd?: string;
     diffCap?: number;

package/dist/gates/acceptance.js

@@ -7,7 +7,7 @@ import { DEFAULT_DIFF_CAP } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
 import { sh } from "../run/git.js";
 import { checkTaskDiffCaps, fetchTaskDiff, isProtectedEvidence, setAsideReceiptPath } from "./review.js";
-import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, verdictNonceLine } from "./llm.js";
+import { appendAnchoredReview, COMPLETION_FAKING_CHECKLIST, extractVerdictJson, generateVerdictNonce, runLlm, SeatLaunchError, verdictNonceLine } from "./llm.js";
 import { classifyVerdictCause } from "./verdict-cause.js";
 import { reviewableLogicDiff } from "./artifact-manifest.js";
 import { classifyFailureOutput } from "./baseline.js";
@@ -442,9 +442,19 @@ Each criteria[].evidence MUST be a structured citation {"path", "line"} whose "p
 The top-level comments array is optional. Use it only for actionable line-anchored feedback.
 `;
     // OBS-1182: an unset seat passes no effort argument at all — the CLI default, and the call shape callers pin.
-    const raw = await (judge.effort
-        ? runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS, judge.effort)
-        : runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS));
+    let raw;
+    try {
+        raw = await (judge.effort
+            ? runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS, judge.effort)
+            : runLlm(judge.adapter, judge.model, prompt, worktree, via, JUDGE_TIMEOUT_MS));
+    }
+    catch (error) {
+        if (!(error instanceof SeatLaunchError))
+            throw error;
+        // OBS-1168(b): no seat, no verdict — run-gates re-routes the judge or parks infra; never a worker charge.
+        return { gate: "acceptance", pass: false, details: `${warn}${detBlock}judge dispatch failed — ${error.message} — failing closed`,
+            meta: { unparseable: true, cause: "seat-launch-failed", judge: channelKey({ adapter: judge.adapter.id, model: judge.model }) } };
+    }
     const extracted = extractVerdictJson(raw, nonce);
     if (!extracted) {
         const cause = classifyVerdictCause(raw, nonce, "pass");
@@ -476,5 +486,17 @@ The top-level comments array is optional. Use it only for actionable line-anchor
         lines.push("judge verdict pass=false");
     lines.push(...inconsistencies);
     const prose = warn + detBlock + (lines.join("\n") || "judge passed");
-    return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted) };
+    // OBS-1151: each criterion's canonical text, ruling and the paths its evidence cites. A legacy quote
+    // cites no path, so its criterion has no comparable subject (missing evidence is unknown). An
+    // inconsistent verdict (a duplicate row ruling both ways, a missing id) carries NO judgment: it is not
+    // a comparable subject, and as an adjudicator it can confirm nothing — run-gates parks it infra.
+    const judgment = inconsistencies.length ? undefined : v.criteria.flatMap((row) => {
+        const index = expectedIds.indexOf(row.criterion);
+        if (index < 0)
+            return [];
+        return [{ id: row.criterion, criterion: renderAcceptanceItem(judgeItems[index]), met: row.met,
+                paths: typeof row.evidence === "string" ? [] : [row.evidence.path] }];
+    });
+    return { gate: "acceptance", pass, details: appendAnchoredReview(prose, extracted),
+        meta: { judge: channelKey({ adapter: judge.adapter.id, model: judge.model }), ...(judgment ? { judgment } : {}) } };
 }

package/dist/gates/baseline.d.ts

@@ -1,5 +1,5 @@
 import { type EvidenceArtifact, type GateEvidenceReceipt, type ShellReceipt } from "../run/protocol.js";
-import type { TickmarkrConfig } from "../config/config.js";
+import { type TickmarkrConfig } from "../config/config.js";
 import type { AcceptanceItem } from "../graph/schema.js";
 import { type RunCapacity, type ShellOptions, type ShResult } from "../run/git.js";
 import type { GateResult } from "./types.js";
@@ -31,8 +31,21 @@ export interface GateEvidenceOptions {
     write?: (path: string, bytes: Buffer) => void;
 }
 export declare const EVIDENCE_TAIL_BYTES: number;
+/** The default per-run quota; `gates.evidenceQuotaBytes` in config overrides it (OBS-1140). */
 export declare const EVIDENCE_RUN_QUOTA_BYTES: number;
+export type RedactionCounts = NonNullable<GateEvidenceReceipt["redaction"]["counts"]>;
+/**
+ * OBS-1139: every category scans the ORIGINAL text on its own; overlapping spans then merge into one
+ * span counted once under its highest-priority member — token, assignment, secret environment, benign
+ * HOME/TMPDIR — so precedence never depends on which match starts first. Counts only: never a value.
+ */
+export declare function classifyGateOutput(text: string, env: NodeJS.ProcessEnv): {
+    text: string;
+    counts: RedactionCounts;
+};
 export declare function redactGateOutput(text: string, env: NodeJS.ProcessEnv): string;
+/** Material means bytes were withheld; a benign location substitution withholds nothing. */
+export declare const redactionMaterial: (c: RedactionCounts) => boolean;
 /** Resolve a snapshot reference against actual bytes: eviction never fabricates a live artifact. */
 export declare function resolveEvidenceArtifact(root: string, ref: EvidenceArtifact): EvidenceArtifact;
 export declare function beginGateEvidence(cwd: string, gate: string, command: string, opts?: GateEvidenceOptions, nonce?: string): {
@@ -55,6 +68,12 @@ export declare function beginGateEvidence(cwd: string, gate: string, command: st
         availability: "available" | "not-started" | "capture-failed" | "killed" | "expired" | "missing";
         redaction: {
             material: boolean;
+            counts?: {
+                token: number;
+                assignment: number;
+                secretEnv: number;
+                benignEnv: number;
+            } | undefined;
         };
         stdout: {
             path: string;